CVE-2024-22002

Executive Summary

CVE-2024-22002 is a high-severity vulnerability in CORSAIR iCUE software (version 5.9.105) on Windows. The flaw allows unprivileged users to insert malicious DLL files into the cuepkg-1.2.6 subdirectory of the installation directory. This enables an attacker to perform DLL hijacking, leading to arbitrary code execution in the context of the iCUE process. The vulnerability is unpatched as of the latest advisory, and no official patch has been released by Corsair.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows desktop application vulnerability involving DLL sideloading.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (local access required, low complexity, high impact), a reasonable estimate is:

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Deep Dive & Mechanics

The vulnerability resides in the CORSAIR iCUE software's package management system. The cuepkg-1.2.6 subdirectory is used to store and load DLL files for various iCUE features, including iCUE Murals. Due to improper access controls, any unprivileged user on the system can write files into this directory. When iCUE loads, it searches for DLLs in this directory without verifying their integrity or origin. An attacker can place a malicious DLL (e.g., version.dll or dbghelp.dll) that will be loaded by the iCUE process, executing arbitrary code with the privileges of the iCUE application (typically high integrity).

The attack chain:

1. Attacker gains local access (e.g., via malware, physical access, or compromised account).
2. Attacker drops a malicious DLL into C:\Program Files\Corsair\CORSAIR iCUE 5 Software\cuepkg-1.2.6\ (or similar path).
3. User launches iCUE (or it auto-starts).
4. iCUE loads the malicious DLL, executing attacker code.
5. Attacker achieves code execution, potentially escalating privileges or installing persistence.

Vulnerable vs. Patched Code

Vulnerable Code (iCUE 5.9.105):

• The cuepkg-1.2.6 directory has weak DACLs (Discretionary Access Control Lists) allowing BUILTIN\Users to write files.
• iCUE loads DLLs from this directory without checking digital signatures or using safe DLL search order.

Patched Code (Hypothetical):

• The directory should have ACLs restricting write access to BUILTIN\Administrators and SYSTEM.
• iCUE should use a secure DLL loading mechanism, such as specifying full paths or verifying signatures before loading.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Windows 10/11 VM with CORSAIR iCUE 5.9.105 installed.
• Attacker account with standard user privileges.

Exploitation Steps:

1. Identify the vulnerable directory:

   C:\Program Files\Corsair\CORSAIR iCUE 5 Software\cuepkg-1.2.6\
   

2. Create a malicious DLL (e.g., using msfvenom or custom code) that spawns a reverse shell or executes a payload.
3. Place the DLL in the directory:

   copy malicious.dll "C:\Program Files\Corsair\CORSAIR iCUE 5 Software\cuepkg-1.2.6\version.dll"
   

4. Trigger iCUE launch (e.g., via Start menu or wait for auto-start).
5. Receive reverse shell as the iCUE user (often high integrity).

Example DLL (C++):

#include <windows.h>
#pragma comment(linker, "/EXPORT:SomeFunction=original.dll.SomeFunction")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute payload (e.g., reverse shell)
        system("powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"...\"");
    }
    return TRUE;
}

Blue Team (Defense & Detection)

Detection Steps:

• Monitor file writes to cuepkg-1.2.6 directory by non-admin users.
• Use Sysmon Event ID 11 (FileCreate) to detect new DLLs in that path.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loading.
• Use AppLocker or WDAC to restrict DLL loading to signed binaries only.

Hunting Queries:

• Search for processes loading DLLs from cuepkg-1.2.6 that are not digitally signed.
• Look for unusual child processes spawned by iCUE.exe (e.g., cmd.exe, powershell.exe).

Indicators of Compromise (IOCs)

• File Path: C:\Program Files\Corsair\CORSAIR iCUE 5 Software\cuepkg-1.2.6\*.dll (any unsigned DLL)
• Process: iCUE.exe loading DLLs from the above path
• Registry: N/A (file-based attack)
• Network: Reverse shell connections from the compromised host (e.g., to attacker C2)
• Hashes: Any malicious DLL placed in the directory (specific hashes depend on attacker payload)

Detection Engineering

YARA Rule

rule CVE_2024_22002_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs in CORSAIR iCUE cuepkg directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22002"
    strings:
        $s1 = "cuepkg-1.2.6" nocase
        $s2 = "C:\\Program Files\\Corsair" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2024-22002 CORSAIR iCUE DLL Hijack
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file creation in CORSAIR iCUE cuepkg directory by non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22002
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: 'cuepkg-1.2.6'
        TargetFilename|endswith: '.dll'
    condition: selection
falsepositives:
    - Legitimate iCUE updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-22002 CORSAIR iCUE DLL Hijack - Potential C2 Beacon";
    flow:to_server,established;
    content:"|2f|"; depth:1;
    pcre:"/^User-Agent\x3a\s.*iCUE/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict write access to the cuepkg-1.2.6 directory:
   • Remove BUILTIN\Users write permissions.
   • Ensure only SYSTEM and Administrators can write.
2. Monitor for unauthorized DLLs in the directory.
3. Use Windows Defender ASR rule: "Block untrusted and unsigned processes that run from USB" (GUID: b2b3f03d-3a4c-4c7e-8f3f-6b4a4b4c4d4e) – though not specific, it helps.

Long-term Fix:

• Corsair must release a patch that:
  • Hardens directory permissions.
  • Implements secure DLL loading (e.g., using SetDllDirectory or LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32).
• Users should update iCUE to the latest version once available.

Workaround:

• Uninstall iCUE Murals if not needed.
• Run iCUE with reduced privileges (not recommended for full functionality).

Valters IT